Block Firewall Rule matched but still able to access page ?

[George_Sas]

Hi Guys.

I have a strange issue... 

I am blocking Social network sites on the firewall and only a few selected people have access to it.
When the BLOCK rule is matched , the people are redirected to a "Blocked" page.

In the APP section I have a rule number 22 (as example) that allows Facebook for specific AccessRole.
Then lower down I have Rule 134 That blocks Facebook and Adult content sites and Redirects to Blocked Page.

Rule 136 Is the Allow rule for Internet Access 

Now , when I try to access Facebook , I can see in the log files match on Rule 134 , the REDIRECT to block page action but the user is still able to surf on Facebook ??
If I am trying an adult site , I see same rule match in logs but I am not able to surf to the adult website.

Why ? I am totally confused.

[George_Sas]

So , Facebook and Adult content are Blocked by the same rule. 134 !
Traffic to both Facebook and Adult site HIT the same Rule 134 ! 

If I visit Facebook I just get an Action REDIRECT and in session : https Traffic Redirected from George (xxx) - (10.131.90.60) to Facebook - (157.240.200.3)
... and I can continue surfing on Facebook . So traffic is REDIRECTED to Facebook but NOT Blocked ..

If I try an adult page I get Action Block and I get the IT blocked page...

Same blocking rule contains "Pornography" and "Social Networking". Rule is matched on both cases but Facebook is allowed and Pornography blocked.

I am more confused.

[Chris_Atkinson]

Please share some additional information to assist i.e.

* Major Version

* Jumbo Take

* HTTPS inspection

* Updated Trusted CA

Anecdotally I've observed better consistency with categorisation in R82+ but might need a TAC case to understand your issue further.

[George_Sas]

Cluster runs R81.20 Jumbo Hotfix 127.
As you see , HTTPS is enabled and the Trusted CA are up to date , just checked yesterday.
But this should not be about HTTPS inspection ,it's an application rule... maybe I am wrong.

[the_rock]

Mind sharing your https inspection policy? Im wondering if there is specific rule there causing this. Keep in mind, that policy would always take precedence first.

[George_Sas]

I have a bunch of Bypass (but I can see the Facebook is inspected) policies and last in row the HTTPS Inspect.

[the_rock]

Mind sharing full log from smart console? Please blur out any sensitive data.